What do the Structure Checks and Argument Checks master switches do; what happens if I turn them off?

Short answer

Structure Checks and Argument Checks are the two vService-wide master switches of the Check Fields inspections in the page types, and both are on when WAF is turned on. Structure checks manages the length, count, size, depth, value pattern and invalid body inspections (Path length, Query key count, Total query size, XML depth, Header value pattern, Block invalid JSON contents …); Argument Checks manages the allowed and required name lists (Allowed query parameters, Required headers, Allowed JSON keys …), and while it is off, the traffic analysis does not produce suggestions for these lists. When a switch is turned off, the related inspections do not run and their fields are hidden in the rule forms; the values in the rules are not deleted, and when the switch is turned on, they return with the same values. Allowed methods, Block all JSON/XML/form contents, the mime type lists, Block unparsed contents, Block unexpected parser errors, the OWASP signature scanning and the blacklist are not affected by these switches. The switches are changed from the Checks window and saved with Edit.

Inspections Managed by the Switches

Section	Structure checks	Argument checks	Independent of both switches
Path	Path length, Path depth	-	Allowed methods
Query	Query Key Length, Query Key Count, Total Query Size, Query Value Length, Query Value Count, Query Value Pattern	Allowed Query Parameters, Required Query Parameters	-
Header	Header Key Length, Header Key Count, Total Header Size, Header Value Length, Header Value Count, Header Value Pattern	Allowed headers, Required headers	-
JSON	JSON Key Length, JSON Key Count, JSON depth, JSON Value Length, JSON Value Pattern, Block Invalid JSON Contents	Allowed JSON Keys	Block All JSON Contents
Xml	XML key length, XML Key Count, XML depth, XML Value Length, XML Value Pattern, Block Invalid XML Contents	Allowed XML Keys	Block All XML Contents
Form	Form key length, Form Key Count, Form Value Length, Form Value Count, Form Value Pattern, Block Invalid Form Contents	Allowed Form Fields, Required Form Fields	Block All Form Contents, Allowed Upload Mime Types
Raw	Raw Body Size	-	Allowed Raw Body Mime Types, Block Unparsed Contents, Block Unexpected Parser Errors

• While off: The inspections managed by the switch are not written to the rule and do not run; the fields are not visible in the rule form and in the detail panel of the page type. The values stay in the record.
• Learning while Argument checks is off: The traffic analysis does not suggest allowed and required name lists; the Max. Allowed Arguments field is also hidden in the window (What is Max. Allowed Arguments for; what happens if a page's learned argument list exceeds this number?).
• Mode: The structural and argument inspections run in the Monitor and Blocking modes; they do not run in the Learning mode (What does the WAF do in Learning mode; are attacks blocked?).
• Scope: The setting applies across the vService and is common to all host groups.

Changing the Switches in TR7

1

Adım 1 Open the Checks window

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management tab, the pencil icon at the top right of the Checks card in the Inspection & Blocking section is clicked.

2

Adım 2 Change the switch

The Structure Checks or Argument Checks switch is turned on or off.

3

Adım 3 Save

Edit is clicked; the change is applied without a separate deployment step. In a cluster setup, it is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent to the peer device manually.

• Result: While both switches are on, the Checks card shows Structure checks and Argument checks are applied to requests, and while one of them is off, it shows Only … is applied to requests; the switch that is off is listed in the … is off line (together with an off URL Decoding, in the … are off line).
• WEB-CLI: waf options update poolId <vService> --syncWithDefaultFwRules false --structureChecks false or --argumentChecks false (basic inspections); to turn it back on, the value true is written.

When Are They Turned Off?

The switches are turned off only if only the signature scanning and the blacklist are wanted and the page-based positive model will not be used. If it is necessary to switch to the Blocking mode before the learning is complete, instead of turning off the switch, the behavior of the pages that have not been learned is determined with Rule Creation Policy and verified in the Monitor mode (When should I move from Learning to Monitor and from Monitor to Blocking?).

Common Misconceptions

• "Turning off the switch deletes the rules." The values stay in the record; they are only not applied.
• "While both switches are off, WAF does not protect." The OWASP signature scanning, the blacklist and the inspections independent of the switches (Allowed methods, Block All … Contents, mime types, Raw switches) continue to run.
• "While Argument checks is off, the learned lists are deleted." The existing lists stay; they are only not applied, and no new list suggestion is produced.

How it is done in the documentation

• Checks · What Is Checks?
• Checks · Structure Checks
• Checks · Argument Checks
• WEB-CLI waf options · The Basic Inspections

Related questions

• What is Check Fields; into which seven parts does the WAF split a request to inspect it?
• What is Max. Allowed Arguments for; what happens if a page's learned argument list exceeds this number?
• When should I move from Learning to Monitor and from Monitor to Blocking?